Apple Distribution – €8,000,000 Fine (France, 2022)

On March 10 2021, the French DPA received a complaint against Apple ('provider' or 'the company') regarding the iOS and MacOS operating systems. According to the complaint, there was a setting called ‘personalised ads’ in the settings of Apple devices which was activated by default. Subsequently, the DPA carried out multiple investigations into the company. The investigation was limited to iOS version 14.6, Apple’s operating system for iPhones. During the investigation, the DPA found that part of the companies processing was the ‘search ads’ service, which was used to personalize ads in the Apple App Store. This service allowed developers to advertise their application in the App Store based on different criteria, such as, but not limited to, device type, age and gender. If the 'personalised adds’ function was enabled in the iPhone settings, the ads displayed to the data subject in the App Store would be personalized using this data. If this setting was disabled, data subjects would receive an ad which was not personalized. The technical workings of the 'personalised adds' setting was analysed by the DPA based on information provided by Apple. The DPA stated that the setting involved multiple identifiers which were created on the data subject's iPhone and the companies servers at different stages of using the phone and setting it up. The identifiers served different purposes related to advertising in the App Store. Apple had two French subsidiaries called Apple France and Apple Retail France. In the context of the ‘search ads’ service, Apple France employed “search ads specialists’, which had to provide assistance to app developers when they were using Apple’s advertising platform in order to target the relevant audience. In its defence, the company had, among other things, argued that the French DPA was not competent in this case. Apple argued that the GDPR was applicable and that the Irish DPA was instead the competent authority under the one stop shop mechanism. Material competence of the French DPA This decision revolves around advertising identifiers that made Apple's advertising ecosystem possible. Such identifiers essentially operate like tracking cookies. Therefore, the French DPA focused on a possible violation of Article 82 of the French Data Protection Act, which in turn implements Article 5(3) of the ePrivacy Directive into the French legal framework. This provision requires the company (rectius, the service provider) to seek the user's previous consent in order store or access information on the terminal equipment of the user. Thus, in order to determine if Article 82 was applicable, the DPA investigated the existence of read - or write operations with regard to the different identifiers that Apple used for offering personalised adds. The DPA concluded that Apple was reading and/or writing with regard to these identifiers on devices of data subjects. The DPA also discussed the difference between the ePrivacy directive and the GDPR. The DPA stated that the reading/writing operations in this decision were covered by Article 82 of the French Data Protection act which operates as lex specialis to the GDPR and therefore takes precedence over the general Regulation. Hence, the French DPA found itself materially competent under French law with regard to such reading and writing operations (i.e. the installation and access to Apple's mobile advertising identifiers). This obviously does not rule out the GDPR application for the subsequent processing of personal data collected using these identifiers. However, this decision did not concern any subsequent processing but only the reading/ writing operations. Therefore, the GDPR and the 'one stop shop' mechanism were not applicable here. Territorial competence of the French DPA In order to assess if the DPA was territorially competent to handle this decision under Article 3 of the Data Protection Act, the DPA assessed if Apple fulfilled the following two criteria: (1) the provider needed to have an establishment on French territory, which was the case according to the DPA. Apple had two French subsidiaries, Apple France and Apple Retail France. (2) There also needed to be processing which was carried out in the context of activities of an establishment. The DPA referred to another of its decisions ([https://gdprhub.eu/index.php?title=CE_-_451423 AMAZON EUROPE CORE of 27 June 2022]). The DPA stated in this decision that the processing could be in the 'context of the activities of an establishment' when this establishment merely provided the promotion and sale of advertising space to make the provider's services profitable, when the provider's processing was carried out on the territory of a member state and entailed collecting personal data with advertising trackers. In this Amazon decision, the DPA also mentioned that this criterion was fulfilled when the activity entailed the promotion and marketing for advertising tools of the provider, which primarily operate with personal data collected with the use of advertising trackers. ([https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2022-06-27/451423 See points 10 and 15 of this Amazon decision - link to original decision in French]). The DPA considered that this second criterion was fulfilled in this decision. Every iPhone sold in France contained the App Store, which came with the companies identifiers. Therefore, the establishment Apple Retail France helped data subjects owning an iPhone accessing the App store and carry out searches, which would result in these data subjects being personalized by the identifiers. With regard to the other subsidiary/establishment, Apple France, the DPA noted that it employed 'search ads specialists', who assisted app-developers with their ad campaigns. Therefore, the DPA concluded that there was a clear link between the activities of Apple's subsidiaries and the reading/writing operations regarding the identifiers used by Apple. Did the provider violate Article 82 of the Data Protection Act? The DPA explained that Article 82 of the Data Protection Act required the provider to ask consent of data subjects if it was reading/writing information to the user’s device. There were however two exceptions to this consent-requirement. The provider did not have to obtain consent if the sole purpose of the identifier was to facilitate communication by electronic means or when the identifier was strictly necessary for the provision of an online communication service at the express request of the data subject. If an identifier had more than one purpose, for example providing communication and advertising, the provider could only use the identifier for advertising when it had obtained prior consent from the data subject for this specific advertising purpose. The DPA therefore determined it necessary to assess the purposes of the different identifiers used by Apple. The DPA concluded that none of the companies identifiers were exclusively intended to allow or facilitate communication. They were also not strictly necessary for the provision of an online communication service at the request of the user. Therefore, none of the exceptions in Article 82 of the Data Protection Act were applicable, and Apple had to obtain consent (Article 4(11) GDPR) before using the identifiers. The DPA reiterated that the companies advertising setting was enabled by default on the iPhone. Therefore, data subjects could not give consent Apple's targeted adverting operation. The option to consent to this personalized adverting was also not integrated in the iPhone’s setup process. Besides that, the DPA also stated that the setting was buried too deep in the iPhone’s settings. According to the DPA, it took a large number of steps to get to this setting. The DPA also considered that Apple was implementing processing on a large scale (given the market position of iOS) and stated that the targeting was based on interests and lifestyle habits. Therefore, data subjects should be provided the option to give valid consent, which was not the case here. Therefore, the DPA determined that the company violated Article 82 of the French Data Protection Act. The DPA added that Apple had provided a new consent box in its new version of the operating system, iOS 15, which fixed the shortcomings of iOS 14.6. However, this was not enough to mitigate the existence of breaches relating to iOS 14.6. After considering several mitigating and aggravating factors, the DPA fined Apple €8,000,000.